Stories
30
Sources
15
Topics
12
For You lens
26 stories in this edition match your reader profile.
Reader signals
3
Searches
0
Matches
26
Top score
97
Search Intent
cs_cc
This query becomes a recent For You signal, so matching stories can move up on the next personalized pass.
Edition Index
Topic, entity, and source map
Topics
Entities
Lead Story
Meta’s Muse Agent Almost Cost Me $408
• The Big Read: Investor Anjney Midha cut Anthropic an early check. His hot streak has kept going • Plus, Recommendations—our weekly pop culture picks: “ Our Town ,” “ Profits, Prophets, Coaches, and Kings ” and “ The Gentlemen ” A hotel room’s quality can be measured in terms of abundance: extra towels, spare bathrobes—plenty of Nespresso pods. Multiples of everything are almost always better. But what’s less pleasant is to inadvertently end up with multiple hotel rooms . A couple days ago, though, I found myself with the unfortunate opportunity to occupy a pair of accommodations at a Santa Monica, Calif., Marriott thanks to an error by my lil’ digital buddy: Muse, Meta Platforms’ new personal agent. The cumbersome, vexing tool hopes to seize on Silicon Valley’s zeitgeisty enthusiasm for popularizing autonomous AI. After a few days with it, I can’t imagine it’s the technology that will take agents mainstream. That hotel snafu came when I gave Muse the hotel’s name and asked it to book two nights. I plugged in my credit card details—a circuitous process that involved both Chase and Stripe—and was met with the digital equivalent of a shrug: An error message informed me that Muse hadn’t completed the transaction, and while it really didn’t know why it couldn’t, it assured me that my credit card hadn’t been charged. A little human skepticism led me to double-check its promise—good thing I did. In fact, the charge had gone through. What happened next still intrigues me. I gave Muse a screenshot showing the charge on my credit card and told it that the charge had gone through. Lickety-split, it returned with a Marriott confirmation number. Not bad—it finished the task without being instructed to do so. But somehow the AI managed to make two bookings: When I showed up to the hotel, I found two rooms waiting for me. The front-desk clerk showed some mercy and canceled one. Had a little human kindness not prevailed, I would’ve been out an extra $408, plus taxes and fees. I’d been pretty gung-ho to try Muse. We’ve spent the past year in increasingly complex discussions about agents ever since OpenClaw came out in January , marking what has felt like the beginning of a distinct new chapter in the AI era. Most of the agents that initially captured attention were meant to simplify work tasks. More recently, a couple of startups have captured buzz with ones devoted to improving life outside the office: The most talked-about one is from Instinct, a startup founded last year. (Instinct is so popular that it now faces a profound compute shortage, and it has recently been seeking additional fundraising that would value it at around $10 billion. Just a month ago, it was valued at $2.5 billion.) But Instinct isn’t widely available, so Muse felt like my first real chance to see what a personal agent could do. The recent reporting from my colleague Jyoti Mann made me even more curious to play around with it: Clearly, Meta sees Muse as a major new product , one aimed at the same everyday people who log on to Instagram and Facebook by the billions. Still, if their experiences are anything like mine, they’ll find Muse something of a misery. The hotel problem wasn’t the only hiccup I ran into with Muse. When I initially set up a account while on my work laptop using my phone number, I later couldn’t access it on my Mac mini at home or my iPhone: Login codes sent via text led me nowhere—just to more error messages. (Frankly, it’s a marvel I found the Muse app at all earlier this week, buried as it was below several other apps also named Muse in Apple’s App Store; it has since risen to the top.) Eventually, I caved and created a second account—this one linked to my Facebook account, which itself is tied to my phone number. Why couldn’t Muse pick up on the overlapping connections? I wish it could have. Later, I did get Muse to complete a Resy reservation and schedule an Uber. I can’t truthfully tell you it was faster or easier than if I’d just gone directly to those apps. After a while, I hit an existential conundrum. I’d given it the tasks that occurred to me, which numbered a small handful. What else could I get Muse to do? I’ve found interacting with the AI something like trying to wrangle a lackluster employee. If I wanted to maximize its potential, I’d need to think deeply and creatively about what else it could possibly do, coax it and baby it, then bite my nails and hope it actually carried out what I wanted. As I relate these frustrations, I can already hear someone shouting “Skill issue!” at me. But really, I stand by the conviction that mass-market consumer technology shouldn’t require any technical savvy or a lot of effort. Certainly, the best versions of such products do not—even the early versions. If three cars had routinely shown up each time someone ordered their very first Uber ride back in the 2010s, I promise you we’d see more yellow taxis on the road today and fewer Ubers. I don’t see agentic AI as some passing fad, nor am I hoping for such an outcome. The technology’s promise—to automate away some of life’s tedium—is damn alluring. What I expect will happen is that agentic AI will get woven into many existing apps, just as chatbots already populate the internet. People will make regular use of agentic software without ever really knowing it; Anthropic’s Claude, OpenAI’s ChatGPT and Google’s Gemini all already have some agentic capabilities. Obviously, Apple and Google will want to use the technology to make iPhone and Android phones smarter and more useful, and the agents will sync up with what those devices already know and store about us. That would reduce quite a few hurdles to agentic AI. But will new stand-alone apps like Muse take off? I have my doubts—not unless they get much, much simpler and more reliable. Or maybe I’ll just need to learn to see the silver lining in their mistakes. You know what? If I ever again find myself billed twice and double-booked by accident, I know just what to do: Throw a rager in one room, sleep until noon in the other. Maybe Muse can handle ordering the booze. A good party can never have too much. —Abram Brown ( [email protected] ) Weekend’s Latest Stories The Big Read Early Anthropic Investor Seeks VC Glory With Cash and Compute Anjney Midha, 34, wants to get chips in the hands of fledgling startups and academics while he bets on a moment in tech that he describes as the “revenge of the scientists.” Listening: “ Our Town ” The good folks of Gainesboro, Tenn. (population: around 900), know that plenty of outsiders look down their noses at their part of the world—figuring them to be a buncha “backwards, hateful racists,” as one longtime Gainesboro resident puts it. That impression of the place does certainly seem to be why Gainesboro found itself under siege a few years ago when a group of wealthy Christian nationalists started to buy up property in secret, hoping to transform the town into a hotbed for other Christian nationalists: They figured they’d encounter little pushback, especially considering how far their money could go in such an impoverished parish. (I could describe them as white supremacists, but the Christian nationalists do take great umbrage with that label.) “Our Town,” a fast-paced and confidently told podcast from Bloomberg and iHeartRadio, looks at how those Christian nationalists staged their attempted takeover of Gainesboro and how they accumulated their wealth and followers, the latter largely through podcasts. (Sigh—the internet.) It also documents the swift, spirited resistance Gainesboro mounted against them, which cheers the soul and asks us to revisit at least a few of the assumptions about America—and our fellow Americans—that may have become entrenched in our minds. —Abram Brown Reading: “ Profits, Prophets, Coaches, and Kings ” by Jared Diamond Many billions of dollars and quite a few Harvard Business School classes have gone toward trying to figure out what makes a great leader—and turning oafs into passable leaders. Now Jared Diamond, author of the Pulitzer-winning 1998 bestseller “Guns, Germs and Steel,” has set himself the task of defining the essential qualities behind leadership in his latest book, “Profits, Prophets, Coaches, and Kings.” He does so by examining famous figures in business, religion, sports and politics, marking what is surely not the only instance in which Elon Musk has been compared to Genghis Khan. In terms of capitalistic chieftains, Diamond finds that the most distinctive leaders are the ones who’ve had the benefit of both exquisite timing and ruthless execution: Jeff Bezos, for example, outmuscling his competitors in the internet’s Paleozoic Era. As far as politicians go, Diamond points out that the ones we truly remember most aren’t those that simply took a mandate from voters and carried it out, even though we so often say that’s exactly what we want our elected officials to do. Rather, they have championed their own bold ideas and convinced the plebs it was really all part of what they’d originally wanted. All of these conclusions are delivered with Diamond’s dry-humored wonkishness. I enjoyed one in particular: “Once one has decided that one is uniquely qualified to assume the burden of leadership,” Diamond writes, “one’s opinion of oneself is unlikely to change.” —A.B. Watching: “ The Gentlemen ” One of the great joys of “The Gentlemen,” the rollicking “Downton Abbey” meets “The Godfather” concoction from director Guy Ritchie, is to admire how nice Theo James looks as he struts around in magnificent tweed. James plays Eddie Horniman, the fictional Duke of Halstead, and as the Netflix series’ second season begins, it’s just as well that Eddie’s concentrating hard on restoring the family fortune to its fullest extent. The dry-cleaning bills must be enormous: His beautiful wool keeps getting splattered in blood. The first season of “The Gentlemen” found Eddie settling somewhat uncomfortably into his new role: paterfamilias of an old, down-on-its-luck aristocratic family that—much to his surprise—has tied its fortunes to an illicit marijuana operation. In this latest season, Eddie has found his footing and is thinking expansively, which puts him at odds with his business partners: a family of Cockney-accented gangsters—father Bobby (Ray Winstone), who operates from lightly monitored house arrest, and his two children, the very capable Susie (Kaya Scodelario) and strapping, bruised-knuckle Jack (Harry Goodwins). As Eddie’s ambitions get bigger, the stakes get higher and the mood grows darker. And since this is very much a Ritchie production, schemes and mayhem continue to fill the screen in manic fashion. One doltish accomplice gets fed to a tiger. Elsewhere, Eddie helms a chase through London after a motorcycle gang snatches away a $16 million Botticelli, which he needs to appease the Italian mafia. The comic relief comes from Hugh Bonneville’s mincing Lord Hawthorne, who needs bribing too—and lusts for the chance to pull down Jack’s plus fours. (To woo Jack, Lord Hawthorne wines and dines him; a plate of iced oysters is a treat of a “Spartacus” reference .) Whether Eddie can keep everyone in line and on board seems questionable based on Season 2’s flash-forward opening shot: his own bloodied body. Michael Corleone never had it so frantic. —A.B.
The Information AI / 4:10 PM
Why AI Companies Are Building Out Wall Street-Style Finance Teams
The financing boom for the AI build-out is getting bigger and more complicated by the day—and AI companies have been staffing up for the challenge. AI labs including OpenAI and Anthropic, as well as neoclouds such as Nscale, are among a growing number of AI companies building out their capital markets teams and hiring specialists in areas like structured finance. That in part reflects the sheer volume of deals these companies are doing, many of which don’t fit neatly into standard corporate debt. This in-house staff can help when it comes to negotiating with lenders and drilling down into construction, power and other key details. Of course, tech and data center companies have long had in-house teams to handle fundraising, deals and other corporate finance needs. And structured finance is nothing new to the infrastructure world. But the scale of the AI build-out, which bankers peg at around $7.5 trillion in spending over the next five years, has pulled relatively young labs and upstart cloud firms into financing arrangements that are new territory. That means finance professionals, from bankers to investors at private equity, private credit and infrastructure firms, have more options in the form of neoclouds and other AI infrastructure startups, some of which are offering significant pre–initial public offering equity. “It's a new avenue for these people,” said James Howl-Newton, founder of Futura Search Partners, a specialist search firm focused on areas including digital infrastructure finance. As a result, “sponsors are having to deal with additional routes to exits for top performers,” he said. AI companies and infrastructure providers are tapping financing frequently and across different instruments, requiring deeper in-house capabilities and expertise than young tech firms have typically needed. One executive overseeing finance hiring at a neocloud noted that leveraged and structured finance backgrounds bring expertise that can help in areas like working through project diligence and getting banks to sign off on deals. Some AI firms may also want to run their own project finance models so they can move quickly through negotiations and have something to compare to lenders’ models. AI companies aren’t always issuing the debt themselves—that can fall to data center developers or special purpose vehicles, with firms like Blackstone and Apollo providing or arranging chip and other financing. And some of the biggest AI deals are using backstops from investment-grade companies like Nvidia or major cloud providers. Even so, commitments from AI customers often underpin much of the borrowing. And the users of the infrastructure will want to understand what they’re signing up for and their risks if a project runs into trouble. “Hiring of people within that business, responsible for the financing of compute, could prove to be an existential decision,” said Dan McCarthy, founder and CEO of One Search, an executive search firm focused on infrastructure finance whose recent clients include OpenAI. “You want someone who knows where all the pitfalls are, where all the bodies are buried in multibillion-dollar loans.” OpenAI, for its part, in July named Sven Semmelmann as head of compute capital markets. He previously led structured finance at Generate Capital, an investment firm that finances and owns infrastructure projects, and he has also held project finance roles at major banks. OpenAI Chief Financial Officer Sarah Friar, when announcing the hire on LinkedIn, said Semmelmann would oversee financing and partnerships to grow the company’s compute resources. Anthropic, meanwhile, has made several finance hires recently to work on capital markets and compute deals, and also has open positions posted including a capital markets infrastructure financing role. AI infrastructure upstarts are staffing up as well. Nscale, which launched in 2024 and is gearing up for a potential IPO , has been hiring across levels for capital markets and treasury as well as legal roles, calling for experience in areas like structured finance and private credit. SB Energy and Crusoe, which are developing major new data centers for OpenAI and other customers, are hiring across levels for jobs focused on project financings and other structured deals, recent postings show, while AI infrastructure startup Fluidstack is hiring a structured finance lead and a more junior counterpart. The good news for AI companies is that private credit and infrastructure teams, as well as investment banking teams focused on structured or project finance, had been growing even prior to the AI boom, providing a pool of skills that could translate into new twists on structured finance, like big graphics processing unit–backed deals. But that kind of finance talent doesn’t come cheap, especially for more senior people who have a track record of working on large transactions. And the normal tech tactic of dangling stock to lure talent won’t necessarily do the trick in all cases, especially for the most seasoned dealmakers and investors. Financiers would have to weigh a cash-heavy Wall Street pay package, albeit one that can depend heavily on how good bonus season is, against betting a portion of their pay on stock in a private or newly public company. Managing directors in investment banking can make north of $1 million in cash a year, with the biggest rainmakers making considerably more. The part of pay they get in stock at big public banks may vest over a few years but is generally easy to sell after that. For people at big infrastructure or private credit firms, senior employees may also receive carried interest, meaning a share of the profits on the funds or investments they work on, which can become worth millions over time. For instance, an investor at a top infrastructure firm may have several million dollars’ worth of carried interest tied up at their current firm they’d have to leave on the table. An AI company could try to make them whole with stock, which could be tantalizing to some, though others might not want to make a bet on equity in a young company. That might make the most experienced investors—those who’ve seen big infrastructure projects through over many years and know all the tricks of the trade—hard to pry away. New From Our Reporters Exclusive Anthropic’s In-House Payments Tech Push Could Chip Away at Stripe By Stephanie Palazzolo Exclusive China Curbs Humanoid IPOs After Unitree’s Volatile Debut By Jing Yang and Qianer Liu
arXiv AI/ML / 5:35 PM
arXiv paper: Field Converter: Geometry-Initialized Temporal Residual Refinement for World-Grounded Player Pose Estimation from Soccer Broadcasts
A new arXiv AI paper by Simon Khan, Laurent Gajny, and Jennyfer Lecompte, and 1 more studies Field Converter: Geometry-Initialized Temporal Residual Refinement for World-Grounded Player Pose Estimation from Soccer Broadcasts.
Simon Willison LLMs / 11:55 PM
Some thoughts on the Navier–Stokes Millennium Prize Problem
On the Navier–Stokes Millennium Prize Problem introduces an impressive result from OpenAI, who used an unreleased model to produce a resolution to the Navier–Stokes existence and smoothness problem , one of the seven Millennium Prize Problems that have been subject to a $1,000,000 prize since May 24th, 2000. The discovery is somewhat overshadowed by accusations of skulduggery from Tristan Buckmaster, an NYU mathematics professor who was collaborating on related problems with Levent Alpöge, an accomplished mathematician who currently works for Anthropic. Tristan's complaint accompanied a hastily published version of their own results. Here's the PDF describing what happened . The very short version is that Tristan and Levent worked on the problem for almost a year, making extensive use of Claude and Codex (mainly GPT-5.6 Sol), then had a breakthrough on August 15th. The mathematical rumour mill kicked into gear and Tristan and Levent heard that OpenAI had heard that Anthropic had resolved "a major open problem", so they reached out and learned that OpenAI had a team working on a related problem, with a similar approach. Quoting Tristan: I asked when the first prompt had been sent by them. This question was not answered directly by OpenAI for some time. Eventually it was agreed that it had been sent in the past few days, after information about our work had reached OpenAI. I asked whether the model had been trained on, or had access to, our sessions in Codex, into which we had been putting all our drafts for the whole of this project. I was told the model did not look up user data. I asked again, about training, and I did not get an answer. It gets more complicated from there. The OpenAI team offered to wait for Tristan to publish, or to have him author a paper about their result, but were clear that Levent would not be invited as a co-author due to OpenAI's competitive relationship with his employer. Here's how OpenAI described their work: On Tuesday, September 1, we heard rumors that two Millennium Prize problems had been resolved. Inspired by these rumors and by the step change in performance of our internal model, we launched an effort to evaluate it on all open Millennium Prize problems and a few other high-impact problems. [...] The agents arrived at their resolution on Saturday, September 5, about 88 hours after the first agents were launched. Lean formalization and verification took an additional 17 hours via GPT‑6 Astra. Across all attempted problems, the agents sent 4.9 million messages and used about 300 billion output tokens. In the process of resolving the Navier–Stokes problem, the agents sent 2.7 million messages and used approximately 130 billion output tokens. (We don't know the cost structure of the internal model they used, but 300 billion output tokens at public API prices for GPT-6 Astra would cost $15,000,000 .) Here's where they provide their perspective on Tristan and Levent's work (emphasis mine): Our effort began on September 1st after hearing a rumor which we later realized was related to Levent Alpöge, an Anthropic employee, and Tristan Buckmaster, a math professor at NYU. After the completion of our full project and Lean verification (on September 6th), believing from the rumor they also had a solution of Navier–Stokes, we reached out to them to offer a concurrent release of our result and to recognize their priority in a joint announcement. [...] We (the researchers and the agents) did not see any of their work through any means until they released it publicly — in particular, no specific user data was accessed in order to solve this problem. While unlikely, we cannot rule out that de-identified data derived from their usage of our products helped improve our models . However, our proofs differ significantly and even the precise results proved are different in the Euler case (forced vs unforced). My interpretation of what happened here is that OpenAI heard that some Millennium Prize problems had been solved using LLMs and saw this as an opportunity to demonstrate the power of their latest model, without thinking too hard about the optics of scooping a team who had been using OpenAI's own models to work on this problem for the best part of a year. This situation appears to mirror what's happening in the world of computer security right now. Anil Madhavapeddy recently pointed out that Just a rumour of a bug is enough to find a security exploit these days , because if someone knows that some software has an unpatched vulnerability, they can set their agents the task of finding it. Is the same now true of mathematics? Just knowing that there is an unpublished solution to a problem might trigger millions of dollars in LLM spending to get there first. This also highlights one of my ongoing frustrations about how all of this works. When an AI lab says that my data is "used to improve model performance", what does that actually mean ? My two favourite hypothetical questions regarding this used to be: If I'm running Codex and one of my API keys accidentally gets consumed in the context, what are the chances that someone else might ask for an API key in the future and get mine back? (I asked someone at OpenAI once and they called this the "regurgitation" problem and assured me that they take great pains to prevent that... but wouldn't describe how.) If I brainstorm with ChatGPT about potential new directions for my company, what's the chance that information might be exposed to a competitor in six months' time who asks "what might company X plan to do next"? My new preferred hypothetical for this is: If I use ChatGPT to help me partially solve a Millennium Prize problem, what are the chances that my work will influence training such that a later model helps someone else solve it first? Via Hacker News . Tags: mathematics , ai , openai , generative-ai , llms , training-data , ai-ethics
arXiv AI/ML / 5:59 PM
arXiv paper: Silver Rate Is (Almost) Optimal for Gradient Descent Acceleration
A new arXiv AI paper by Yuhan Ye and Kaizhao Liu studies Silver Rate Is (Almost) Optimal for Gradient Descent Acceleration.
AWS Machine Learning Blog / 5:03 PM
Govern models with MLflow and Amazon SageMaker AI Model Registry sync: Part 1
Managed MLflow on Amazon SageMaker AI now syncs richer model metadata (training metrics, evaluation results, inference specs, and lineage) into the SageMaker AI Model Registry, with lifecycle stage promotion. Part 1 shows how to govern candidate models in a single account using IAM guardrails.
AWS Machine Learning Blog / 4:10 PM
Set up OpenAI ChatGPT Codex with LiteLLM on Amazon ECS and Amazon Bedrock
Deploy a customer-operated LiteLLM gateway on Amazon ECS with AWS Fargate, connect it to an OpenAI model on Amazon Bedrock, and configure Codex to route requests through the gateway's Responses API with scoped identities, budgets, rate limits, and telemetry. We also compare direct IAM Identity Center access and a managed Portkey deployment.
Bloomberg AI / 1:52 PM
Chipmaker Longsys Said to Raise $903 Million in HK Listing
Shenzhen Longsys Electronics Co. has raised HK$7.08 billion ($903 million) after pricing its Hong Kong listing below the maximum, according to people familiar with the matter.
YC AI / 4:40 AM
Studio launched from YC as an AI company
Studio is a Summer 2026 YC AI company: Accurately simulate market response at scale.
Hacker News AI / 1:51 AM
Going AI-native to enhance how humans/agents access ScalarDB and ScalarDL docs
HN 2 pts · 0 comments
Cloudflare AI Blog / 1:12 PM
How Cloudflare detects MCP traffic and helps secure it
Cloudflare Gateway identifies MCP requests using protocol-level heuristics. Security teams can use that signal to find shadow MCP traffic, enforce Portal-only access for approved servers, and block direct connections on managed network paths.
MIT News AI / 7:50 PM
Alexander Rakhlin named director of the MIT Statistics and Data Science Center
An expert in machine learning, statistics, and computation, Rakhlin succeeds Professor Ankur Moitra.
The Verge AI / 5:18 PM
Google DeepMind’s new AI model can control a robot’s entire body
Google DeepMind says the latest version of its Gemini Robotics AI model can "control entire humanoid robots." While the previous model focused on controlling a humanoid robot's upper body, Gemini Robotics 2 now supports "whole-body motions" ranging from its feet to fingertips, according to an announcement on Thursday. The new model will allow humanoid robots […]
OpenAI News / 5:00 PM
Scientific computing in the age of agentic AI
A new field report shows how scientists use AI coding agents to modernize scientific computing, accelerating software development and discovery in genomics and beyond.
BAIR Blog / 9:00 AM
Teaching LLMs to Update Beliefs for Efficient Long-Horizon Interaction
.abbel-fig { display: block; text-align: center; margin: 2.4em 0; line-height: 1.4; max-width: 100%; } .abbel-fig img { display: block; margin: 0.65em auto 0; height: auto; max-width: 100%; } /* Image sizes; captions use a narrower measure below */ .abbel-fig--wide img { width: 100%; max-width: 100%; } .abbel-fig--wide-90 img { width: 100%; max-width: 90%; } .abbel-fig--wide-lg img { width: 100%; max-width: 100%; } .abbel-fig--chart img { width: 100%; max-width: 82%; } .abbel-fig--chart-sm img { width: 100%; max-width: 64%; } .abbel-fig--portrait img { width: 50%; max-width: 520px; } .abbel-fig--equation img { width: 100%; max-width: 52%; } .abbel-fig--video { width: 110%; max-width: 110%; margin-left: -5%; margin-right: -5%; box-sizing: border-box; } .abbel-fig--video .abbel-frames { max-width: 100%; width: 100%; } .abbel-frames { margin: 0.65em auto 0; max-width: 100%; user-select: none; } .abbel-frames__stage { position: relative; cursor: pointer; border: none; background: transparent; line-height: 0; width: 100%; } .abbel-frames__stage img { width: 100%; height: auto; display: block; } .abbel-frames__hint { position: absolute; right: 0.55em; bottom: 0.55em; background: rgba(0,0,0,0.4); color: #fff; font-size: 0.68em; font-style: normal; padding: 0.18em 0.5em; border-radius: 3px; pointer-events: none; opacity: 0; transition: opacity 0.2s ease; } .abbel-frames__stage:hover .abbel-frames__hint, .abbel-frames.is-paused .abbel-frames__hint { opacity: 1; } .abbel-frames.is-playing .abbel-frames__hint { opacity: 0; } .abbel-frames__controls { display: flex; align-items: center; justify-content: center; gap: 0.55em; margin-top: 0.35em; flex-wrap: wrap; } .abbel-frames__controls button { appearance: none; border: none; background: transparent; color: #999; font: inherit; font-size: 0.78em; padding: 0.15em 0.35em; border-radius: 2px; cursor: pointer; } .abbel-frames__controls button:hover { color: #666; background: transparent; } .abbel-frames__controls button.abbel-frames__next, .abbel-frames__controls button.abbel-frames__prev { color: #bbb; font-weight: 400; } .abbel-frames__controls button.abbel-frames__next:hover, .abbel-frames__controls button.abbel-frames__prev:hover { color: #999; } .abbel-frames__controls button#abbel-frames-play { color: #777; letter-spacing: 0.02em; } .abbel-frames__controls button[aria-pressed="true"] { background: transparent; color: #555; border-color: transparent; } .abbel-frames__meta { font-size: 0.72em; color: #bbb; font-variant-numeric: tabular-nums; min-width: 4em; text-align: center; } .abbel-frames__dots { display: flex; justify-content: center; gap: 0.25em; margin-top: 0.25em; flex-wrap: wrap; } .abbel-frames__dots button { appearance: none; width: 0.4em; height: 0.4em; padding: 0; border-radius: 50%; border: 1px solid #ccc; background: #fff; cursor: pointer; } .abbel-frames__dots button[aria-current="true"] { background: #aaa; border-color: #aaa; } .abbel-fig .abbel-fig-cap, i.abbel-fig-cap { display: block; text-align: center; font-style: italic; color: #444; margin: 2.7em auto 0.15em; max-width: 38em; width: 100%; box-sizing: border-box; padding: 0 0.5em; font-size: 0.8rem; line-height: 1.4; } .abbel-fig .abbel-fig-cap sub, .abbel-fig .abbel-fig-cap sup, i.abbel-fig-cap sub, i.abbel-fig-cap sup { font-size: 0.75em; line-height: 0; } .abbel-fig--tight .abbel-fig-cap { margin-top: 0.9em; /* ~1/3 of default figure→caption gap */ } .abbel-fig--equation .abbel-fig-cap { margin-top: 1.35em; /* half of default 2.7em figure→caption gap */ } .abbel-fig--chart-sm .abbel-fig-cap { margin-top: 1.35em; /* one line less than default 2.7em */ } @media screen and (max-width: 40em) { .abbel-fig--wide img, .abbel-fig--wide-lg img, .abbel-fig--wide-90 img, .abbel-fig--chart img, .abbel-fig--chart-sm img { max-width: 100%; } .abbel-fig--equation img { max-width: 75%; } .abbel-fig--portrait img { max-width: 50%; } .abbel-fig--video { width: 100%; max-width: 100%; margin-left: 0; margin-right: 0; } .abbel-fig--video .abbel-frames { max-width: 100%; } .abbel-fig .abbel-fig-cap { max-width: 100%; } } .abbel-footnotes { font-size: 0.8em; color: #888; font-style: italic; margin: 1.5em 0; } .abbel-footnotes ol { padding-left: 1.25em; margin: 0.4em 0 0; } .abbel-footnotes li { margin: 0.55em 0; } .abbel-footnotes p { margin: 0.2em 0; } .abbel-footnotes a { color: #888; } .abbel-table-wrap { overflow-x: auto; margin: 0.5em auto 0; text-align: center; } .abbel-fig--table { margin: 2.4em 0; } .abbel-fig--table .abbel-table-wrap { margin: 0.65em auto 0; } .abbel-table { width: 100%; max-width: 560px; margin: 0 auto; border-collapse: collapse; font-size: 0.88em; line-height: 1.35; } .abbel-table th, .abbel-table td { padding: 0.5em 0.7em; border-bottom: 1px solid #ddd; text-align: center; vertical-align: middle; } .abbel-table th { border-bottom: 2px solid #333; font-weight: 600; } .abbel-table th:first-child, .abbel-table td:first-child { text-align: left; } .abbel-table tr.abbel-baseline td { color: #888; font-style: italic; } .abbel-ack a { color: #1565c0; font-weight: 500; text-decoration: none; border-bottom: 1px solid #90caf9; padding-bottom: 0.06em; } .abbel-ack a:hover { color: #0d47a1; border-bottom-color: #1565c0; } /* Suppress "View on alphaXiv" badges/tags (browser extension / userscript injectors) */ a[href*="alphaxiv.org"], a[href*="alphaXiv"], [class*="alphaxiv"], [class*="alphaXiv"], [class*="AlphaXiv"], [id*="alphaxiv"], [id*="alphaXiv"], [data-alphaxiv], [data-alpha-xiv], img[src*="alphaxiv"], img[alt*="alphaXiv" i], img[alt*="alphaxiv" i], button[aria-label*="alphaXiv" i], a[title*="alphaXiv" i], a[aria-label*="alphaXiv" i], span[title*="alphaXiv" i] { display: none !important; visibility: hidden !important; width: 0 !important; height: 0 !important; overflow: hidden !important; pointer-events: none !important; position: absolute !important; left: -9999px !important; } /* Section / subsection spacing (title → body, and gap before next section) */ .post-content > h2 { margin-top: 2.6em; margin-bottom: 0.75em; } .post-content > h2:first-of-type { margin-top: 1.6em; } .post-content > h3 { margin-top: 1.85em; margin-bottom: 0.6em; } Overview of ABBEL compared to traditional recursive summarization. Beliefs replace the full interaction history as the agent’s working context, and belief grading improves performance by supervising the contents of each belief state.. As task horizons grow, LLM contexts can’t scale forever. Self-summarization enables concise, interpretable contexts, but at a significant performance cost, especially for human assistance domains where high quality data is scarce, e.g., collaborative code generation. We address this with ABBEL : a framework that isolates and supervises the information content of summaries in the form of natural-language belief states. Motivation: the cost of recursive summarization For language models to effectively assist with increasingly complex tasks such as software development, they must be able to interact with us over hundreds or even thousands of steps. For such long tasks, it is impractical to keep the history of the entire interaction in context. The heuristic approach used so far has been summary generation, sometimes called context compaction. For example, Cursor’s latest model composer 2.5 uses compaction during training for improved performance ( Cassano et al., 2026 ). Alongside composer, Grandcode ( DeepReinforce et al., 2026 ), the first system to consistently beat all human competitors in online coding competitions, despite using one of the newest efficient attention models (Qwen 3.5-397B), 1 still found it necessary to employ context summarization. But compaction has a problem. Despite seemingly low performance gaps in benchmarks, model servers like Cursor continue to recommend that users avoid compaction with their coding assistants in the middle of a task ( Heule et al., 2026 ). To understand why, see below the performance over RL fine-tuning of a Context summary model compared to full context models in Combination Lock, a Wordle-like game that allows up to 16 guesses. 2 Though both model types improve over the course of training, the summary model never closes the gap. Fig. 1: Average attempts to guess the target word on Combination Lock over RL fine-tuning (lower is better). Context-summary policies improve with training but do not close the gap to full-context policies. Making models self-summarize while completing a task increases the complexity of the learning problem. While this could typically be addressed by training with more data, the performance degradation observed in real world interactive settings likely arises from the difficulty we have in creating and using human simulators effectively to generate high quality training environments ( Lin et al., 2025 , Tomlin et al., 2025 ). Thus, the better you can learn to summarize on the limited and messy multiturn interaction trajectories you can collect, the better off your model will be for downstream users. ABBEL: acting through belief bottlenecks Fig. 2: Autoencoder-inspired belief grading. The model encodes prior belief, action and observation (b t , a t , o t ) into posterior belief b t+1 and is rewarded for how well select information from the history can be reconstructed from that belief. To address poor learning efficiency, we isolate the summary generation task. Drawing inspiration from recursive Bayesian estimation, we formulate summaries as belief states, which we periodically prompt the model to update based on new information. 3 Click to pause --> ‹ Prev Pause Next › 1 / 16 Fig. 3: ABBEL rollout. Belief updates from the latest observation alternate with action selection conditioned only on the current posterior belief. Belief grading We then extract and supervise the contents of the belief states (Fig. 2, Belief Grading). Belief grading can be thought of as adding an auxiliary RL task, using heuristics designed to capture what makes a good belief as the reward. An example heuristic for coding could be shorter is better, but closer to being able to reconstruct the git diff is also better, so balancing these would yield a good belief. In domains where good heuristics are hard to define, we propose a general autoencoding-inspired grading function, which treats the current language model π θ as both encoder and decoder of information from the history, and the belief states as the codes. We grade each belief b t+1 by how well it can be used by the current model π θ to reconstruct the most recent observation o t : Eq. 1: Reconstruction grading objective. Here b t+1 is the updated belief, o t the latest observation, a t the action just taken, b t the prior belief, p I the task prompt, and π θ the current model. Higher grades reward beliefs that retain information needed to decode the latest observation. What do we gain by grading beliefs? Collaborative coding on CollabBench We demonstrate the utility of belief grading in our motivating domain of human-driven assistive coding, with the CollabBench environment from Sweet-RL ( Zhou et al., 2025 ). Fig. 4: CollabBench collaborative coding environment. The agent asks clarifying questions, then submits a function scored against hidden unit tests. We see that with the general reconstruction-based belief grading function we reduce the performance gap from full context models by about 50%, and train in 50% fewer steps compared to training models to summarize without belief grading (no BG). After training, ABBEL still uses significantly less memory than the full context setting, as measured by the peak context token length (Peak Tokens). Model Test Pass Rate ↑ Success Rate ↑ Peak Tokens × 10² ↓ Training Steps ↓ Full Context 0.52±0.02 0.39±0.02 14.08±0.55 100 ABBEL (no BG) 0.46±0.02 0.31±0.02 4.20±0.37 100 ABBEL-rec-BG 0.48±0.01 0.36±0.01 6.01±0.33 50 Fig. 5: CollabBench results. With reconstruction belief grading, ABBEL-rec-BG recovers about half the gap to full context while using fewer peak tokens, and trains in 50 steps instead of 100. Combination Lock Additionally, in CombinationLock, we demonstrate that ABBEL with a belief grader which leverages domain knowledge (by computing useful statistics over the history and checking that they can be reconstructed from the belief state), enables even higher learning efficiency than full context (FULL CTX) models. Fig. 6: Average attempts to guess the target word on Combination Lock (lower is better). With domain-knowledge belief grading, ABBEL approaches or exceeds FULL CTX in this setting; without belief grading, learning is slower. Multi-objective question answering In a third environment, multi-objective question answering (from MEM1 Zhang et al., 2025 , a recent work which performed end-to-end optimization in a modified version of typical recursive summarization), we demonstrate the utility of isolating belief states from reasoning, by showing that a Peak Belief length Penalty (more details in paper) significantly reduces memory usage with minimal performance degradation, unlike is commonly observed when penalizing reasoning lengths ( Arora et al., 2025 ). Fig. 7: Exact-match score and peak memory versus number of objectives in multi-objective QA. ABBEL with a peak belief penalty (PBP) maintains comparable performance while using less memory than MEM1 and ABBEL without PBP in this evaluation. Related work Alternative solutions to managing long contexts involve different tradeoffs, and are worth considering depending on the requirements of a deployed system. Context compression methods generate dense representations which, while computationally efficient, sacrifice human-understandability ( Kontonis et al., 2026 , Eyuboglu et al., 2025 , Gupta et al., 2025 , Chevalier et al., 2023 , Deng et al., 2025 , Deng et al., 2025 , Bulatov et al., 2022 ). Hand-designed summarization prompts ( Wang et al., 2025 , Örwall et al., 2025 , Starace et al., 2025 ) and pruning strategies ( Jiang et al., 2024 ) specific to target environments require expert human knowledge and don’t allow an agent to learn what to remember as part of its decision-making strategy. Methods that process long contexts into an external memory store ( Packer et al., 2023 , Xu et al., 2025 ) for the agents or subagents to query ( Zhang et al., 2025 ) are complementary, as they may benefit from better next context creation through summarization training. We would like to point out some exciting works in the space of general recursive summarization focused on math ( Wu et al., 2026 ), reasoning with belief generation ( Zhou et al., 2025 ), competitive coding with a distilled summarization module using similar autoencoding objectives to our general belief grader ( DeepReinforce et al., 2026 ), and adding continuous features to summaries ( Kontonis et al., 2026 ). What’s next for better memory? Many more possibilities are enabled through using explicit belief states as information bottlenecks for multi-step interaction. You could reward actions based on their effect on the belief state to guide exploration, transmit the explicit belief states for better communication between agents, or even improve user controllability by directly modifying the memories on which the agents’ decisions are based. Some forms of information, e.g., what a person looks like, are not represented well by text alone. A continuously learning system will also have to capture such information. Additionally, if we want a system to learn to communicate in a brand new language or to play a brand new game better than any person in the world, the skills accumulated over the lifetime of conversations or games must be stored in a very compressed form, essentially taking on the role of the weights of the model itself. More powerful systems will likely utilize a combination of multiple forms of memory, where the contents of the context may correspond to working memory while other approaches are used for short and long-term memory. How to instantiate these other forms of memory, for instance via test-time training, adapter memories, continuous context memories, or some combination thereof, presents an exciting challenge. Acknowledgements Acknowledgements: We would like to thank Alane Suhr and Kartik Goyal for advising this research as well as Ethan Mendes , David He , Jitesh Jain , and Nicholas Tomlin for comments on early drafts of this post. We would like to thank the MEM1 authors for their email correspondence and for sharing private reviewer feedback which we found particularly insightful. Citation If abbel was inspiring for your future work, please cite us with this! And here is some advice for doing similar research! @misc { lidayan2026abbellearningnaturallanguagebelief , title = {ABBEL: Learning Natural-Language Belief States for Memory-Efficient Interaction} , author = {Aly Lidayan and Jakob Bjorner and Satvik Golechha and Kartik Goyal and Alane Suhr} , year = {2026} , eprint = {2512.20111} , archivePrefix = {arXiv} , primaryClass = {cs.CL} , url = {https://arxiv.org/abs/2512.20111} , } With newer models the number of tokens till 50% compute spend is on attention gets much larger than 25K. Interleaving linear attention alternatives with full attention as is done with gpt-oss and DeepSeekv4, results in massive flops reductions for the attention computation. For example with DeepSeekv4-Pro (1.6T A49B) it requires nearly 450 thousand tokens to reach the 50% tradeoff point. Grandcode uses Qwen-3.5-397B-A17B a model which hits 50% FLOPs for attention at ~150 thousand tokens. ↩ This setting is technically solvable with much more computationally effective tools, but serves as a flexible test bed to study properties of recursive summarization. Bertsimas et al., 2022 , showed that an exact solution for the wordle game instantiated with the original vocabulary of the javascript game can be found with dynamic programming, but evidently the general formulation of wordle as a guessing game on K letters with L attempts and some dictionary of valid words and correct words D is NP hard to determine the minimal number of moves required. ↩ In practice there is an O(N/K) overhead cost for summary. N is the total number of actions. K is the number of actions till summarization is triggered. This is necessarily true for any summary approach. For ease of illustration this gif uses K = 1. In our experiments, to put more emphasis on summarization weaknesses we also use K=1. In practice overhead is small as K can be chosen to be near the efficient hardware limit. ↩ (function () { var root = document.getElementById('abbel-frames'); if (!root) return; var count = parseInt(root.getAttribute('data-frame-count') || '15', 10); var prefix = root.getAttribute('data-frame-prefix') || 'https://bair.berkeley.edu/static/blog/abbel/frames/frame_'; var intervalMs = parseInt(root.getAttribute('data-interval') || '1300', 10); var img = document.getElementById('abbel-frames-img'); var meta = document.getElementById('abbel-frames-meta'); var dots = document.getElementById('abbel-frames-dots'); var btnPrev = document.getElementById('abbel-frames-prev'); var btnNext = document.getElementById('abbel-frames-next'); var btnPlay = document.getElementById('abbel-frames-play'); var stage = root.querySelector('.abbel-frames__stage'); var hint = root.querySelector('.abbel-frames__hint'); var i = 0; var playing = false; var timer = null; var urls = []; for (var n = 0; n
Ars Technica AI / 8:26 PM
xAI can’t deny Grok makes CSAM anymore. So it’s suing users.
Elon Musk's xAI files first lawsuit against Grok user accused of making child sex images.
VentureBeat AI / 7:16 PM
The AI compute gap: Enterprises are buying infrastructure faster than they can measure what it costs
Across 107 enterprises, AI infrastructure spending is accelerating well ahead of the ability to see or steer its economics. Most organizations run their AI on a familiar base of hyperscalers and model-provider APIs, yet the next dollar is aimed at specialized compute almost none of them use today; a majority intend to switch or add providers within the year, many within a quarter. Buying decisions turn on integration and total cost of ownership rather than headline token price — which is fortunate, because most enterprises cannot yet see their unit economics clearly: GPUs sit at half utilization or less, and fewer than half rigorously track what their compute actually costs. The result is a compute gap — heavy, fast-moving investment running ahead of the visibility needed to control it. This wave of VentureBeat Pulse Research examines enterprise AI infrastructure and compute: where organizations are in their deployment journey, what they run AI on today, how satisfied they are, what would make them switch, where they plan to evaluate their investments, and — most revealingly — how well they can measure and control the economics of the compute underneath it all. The central finding is a compute gap — the distance between how aggressively enterprises are investing in AI infrastructure and how little of its economics they can see. Only about one in five (21%) run AI in production at scale, yet spending intentions are outrunning that maturity: the single largest planned area enterprises plan to evaluate over the next year is AI-specialized clouds (45%), a layer almost none of these enterprises use today. Meanwhile the compute already in place runs cold — 83% report GPU utilization of 50% or less — and fewer than half (44%) can rigorously track what their AI compute costs. Enterprises are buying more infrastructure faster than they can account for what they already own. Enterprises are not settled on their infrastructure vendors, either: A clear majority (64%) plan to switch or add an infrastructure provider within twelve months, and 38% within the next quarter — unusually high churn intent for a category this foundational. When they choose, they choose on integration with the existing stack (41%) and total cost of ownership (35%), not on headline price: cost per million tokens is the deciding factor for just 8%. And the frontier constraint that will shape the next round of decisions — the shift from GPU compute to memory bandwidth as inference scales — is barely on the radar, with roughly one in five enterprises either unaware of it or yet to address it. Methodology VentureBeat fielded this survey as part of its ongoing Pulse Research series, this survey focused on enterprise AI infrastructure, compute, and inference economics. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%. By organization size the sample concentrates in the mid-market: 101–250 employees (36%) and 251–1,000 (27%) lead, with 1,001–5,000 (22%), 5,001–10,000 (8%), and 10,001+ (7%) above them. By role it spans managers (38%), individual contributors (28%), VPs and directors (19%), and the C-suite (13%); on purchasing authority it is buyer-credible, with 45% final decision-makers and another 30% recommenders or influencers for AI solutions. Technology/Software is the largest industry at 26%, followed by Healthcare/Life Sciences (15%), Financial Services (13%), and Retail/E-commerce (12%). At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It also skews toward the mid-market and toward earlier-stage adopters, so it is best read as the view from organizations actively building out AI infrastructure rather than from the largest hyperscale operators. Finding 1: Ambition outpaces production Only one in five run AI in production at scale We asked where organizations sit in their AI deployment journey. Most are still building toward production rather than operating at scale. The maturity curve is front-loaded. Three-quarters of enterprises (76%) are either experimenting or running only some workloads in production, and just 21% describe AI in production at scale. This matters for everything that follows: the infrastructure decisions in this report are being made largely by organizations still early in deployment, whose compute footprint — and whose costs — are about to grow. The evaluation and switching intentions in Findings 3 and 4 are the leading edge of that build-out, not the settled preferences of operators who have already found what works. Finding 2: Enterprises run on hyperscalers and model APIs The specialized GPU clouds barely register — today We asked which providers and platforms enterprises currently use to run their AI. The answer is a familiar one: the incumbents. The current stack is hyperscaler-and-API. Google Cloud leads at 48%, and the general-purpose clouds (Google, Microsoft, AWS, Oracle) together with the major model APIs (Gemini, OpenAI, Anthropic) account for essentially all current deployment. The specialized “neocloud” GPU providers that dominate AI-infrastructure headlines — CoreWeave, Lambda, Crusoe, Nebius and peers — register at or near zero among these enterprises today. Only 6% run their own on-prem GPU clusters and 4% a custom open-source stack. Enterprises are, for now, running AI on the providers they already buy from — which makes the evaluation intentions in Finding 3 all the more striking. (A note on reading these shares. As described in the methodology section, this sample is self-selected and skews mid-market, and this question counted every provider a respondent uses — an average of 2.1 selections each — so the figures measure presence in the stack rather than spending or primary status. A sample built this way will show a different provider mix than a spend-weighted census of the broader market; Google's strength here, for example, is consistent with its long-standing position among smaller enterprises building on AI. Read these shares as a portrait of what this AI-active cohort runs today, and treat gaps between these figures and industry-wide market share estimates as a property of the sample rather than a contradiction of either.) Finding 3: The next dollar goes to infrastructure they don’t yet run AI-specialized clouds top the evaluations list We asked where enterprises planned to evaluate AI infrastructure over the next 12 months. Their answers point away from the stack they run today. Here is the report’s sharpest tension. The single most-cited planned evaluation area — AI-specialized clouds, at 45% — is the very category almost none of these enterprises use today (Finding 2). Nearly a third (32%) intend to evaluate non-Nvidia accelerators, and 28% in next-generation Nvidia silicon; even decentralized compute networks (16%) and sovereign compute (11%) draw meaningful interest. Read against current usage, this is not incremental — it is the leading edge of a re-platforming. The direction-of-travel question tells the same story: every infrastructure approach is net-expanding, but specialized AI clouds carry the highest net momentum (+24), edging out even the hyperscalers (+22). Enterprises are preparing to move a meaningful share of AI compute off the general-purpose cloud. This continues a trend we saw in our April-May survey wave. Back then, usage of the AI-specialized clouds was equally marginal — CoreWeave at 3%, Lambda at 4%, Crusoe at 2% of enterprises. When we asked enterprises what change they planned in their AI infrastructure strategy over the next twelve months, the most-cited answer was moving workloads to specialized AI clouds, at 33%. Asked in April-May which emerging compute option they were most likely to evaluate AI-specialized clouds again drew the most responses. Two waves, two differently worded questions, one consistent picture: the type of cloud enterprises are most eager to assess is the type they have barely begun to use. Finding 4: A switching wave is building Six in 10 plan to change providers within a year — many within a quarter We asked whether and when enterprises plan to switch or add an infrastructure provider. Very few intend to stand still. For a category as foundational as compute, this is a remarkable amount of intended movement. Only 36% have no plans to change, meaning a clear majority (64%) intend to switch or add a provider within twelve months — and 38% within the next quarter alone. Where that interest points is telling: the providers drawing the most switching consideration are again the incumbents — Microsoft Azure and Google Cloud (33% each), OpenAI (30%), and Gemini (22%) — which suggests much of the near-term movement is reshuffling among the majors and consolidating spend rather than defecting to new entrants. The neocloud interest in Finding 3 is a 12-month evaluation thesis; the switching in the next quarter is mostly incumbents trading share. ( Method note: Respondents who selected both "no plans to change" and a specific switching window are counted as switchers, on the logic that naming a timeframe is the more specific answer; three respondents were reclassified under this rule. ) Finding 5: Nobody buys on token price Integration and total cost of ownership decide — not sticker price We asked what matters most when enterprises select an AI infrastructure provider. Headline price finished last. Enterprises do not buy AI infrastructure on pricing, which is the place vendors compete on hardest. Integration with the existing stack (41%) and total cost of ownership (35%) dominate, while the headline metric — cost per million tokens — is the deciding factor for just 8%, dead last. The pattern is coherent: buyers are optimizing for how a provider fits and what it truly costs to operate, not for the advertised unit rate. It also foreshadows Finding 7 — enterprises say TCO matters most, yet most cannot yet measure it rigorously. The stated priority and the measured capability are out of step. Finding 6: Expensive GPUs, idle most of the time 83% report GPU utilization of 50% or less We asked what share of their GPU capacity enterprises actually utilize. The answer is a well-known but rarely quantified inefficiency. Disclosure: Band percentages count every selection against all 107 qualified respondents; 14 respondents selected more than one band, so bands overlap. At the respondent level, 83 of the 100 GPU-operating enterprises reported utilization at or below 50% The compute already in place runs cold. Adding the bands at or below half capacity, 83% of enterprises that operate GPUs report utilization of 50% or less, and nearly half (49%) run at 25% or below. Only 12% clear the 50% mark, and a further 8% do not measure utilization at all. Idle accelerators are expensive accelerators, and this is the clearest single measure of the compute gap: enterprises are planning to buy more GPUs and specialized compute (Finding 3) while the capacity they already own sits substantially unused. The efficiency headroom in the current fleet is large — and largely unmeasured. Finding 7: Spending fast, measuring slowly Fewer than half rigorously track what their compute costs We asked whether enterprises can quantify the cost and return of their AI infrastructure spend, and how satisfied they are with what they run. Confidence in the ledger lags the spending. Measurement trails money. Fewer than half of enterprises (44%) rigorously track the cost and return of their AI compute; the majority track only partially (39%), cannot quantify it yet (20%), or have not prioritized it (6%). That gap is consequential given Finding 5, where total cost of ownership was the second-ranked buying criterion — enterprises are choosing providers on an economic basis they mostly cannot yet measure. Satisfaction with current infrastructure is moderately positive but not enthusiastic: on a five-point scale, overall satisfaction averages 4.0, with ease of implementation (3.8) and value for money (3.9) trailing slightly — the softness landing, tellingly, on cost. Enterprises are spending quickly and accounting slowly. Finding 8: The next bottleneck few are watching As inference shifts from compute to memory, the field scatters Finally, we asked how enterprises would address the emerging constraint in large-scale inference — the shift from GPU compute to memory, specifically KV-cache capacity. The responses reveal a frontier that is not yet a priority. The memory frontier is real but barely governed. Asked which approach they would rely on as the binding constraint in inference shifts from compute to memory bandwidth, enterprises scatter: Dell leads at 31%, Nvidia follows at 16%, and the rest fragments across storage vendors, open-source tooling, and model-level efficiency techniques. Most telling is that roughly one in five (18%) either do not recognize the constraint or have not begun to address it. For a shift that will reshape inference cost and architecture, this is an early and unsettled market — and, consistent with the measurement gap in Finding 7, one where many enterprises simply do not yet have a view. It is the next chapter of the compute gap, arriving before most have closed the current one. The bottom line: A compute gap that faster spending will widen, not close Organizations with more than 100 employees are investing in AI infrastructure faster than they can measure it. Most are still early in deployment, yet their spending intentions point past their current stack — toward specialized clouds and alternative accelerators almost none of them run today — and a clear majority intend to change providers within the year. They buy on integration and total cost of ownership rather than headline price, which is rational; the difficulty is that most cannot yet see those economics clearly. The visibility gap is concrete. The GPUs enterprises already own run at half utilization or less for the overwhelming majority, and fewer than half can rigorously track what their compute costs or returns. Satisfaction is decent but unenthusiastic, softest on value for money — the dimension hardest to judge without measurement. And the next constraint, the shift from compute to memory in large-scale inference, is arriving while most enterprises are still unaware of it. At 107 respondents in a single Q2 wave this is a directional read, skewed toward the mid-market and earlier-stage adopters — but the direction is consistent: the appetite to spend is running well ahead of the instrumentation to spend well. The compute gap is not a capacity problem that more hardware will solve on its own; it is, first, a problem of seeing what the hardware already costs. The open question for later waves is whether enterprises build that visibility before the re-platforming arrives — or buy the next layer of infrastructure as blind to its economics as the last. Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single Q2 2026 (June) wave. Because this is one wave rather than a pooled multi-month sample, the results read cross-sectionally rather than as a month-over-month trend, and at 107 respondents this is a directional signal rather than a precise measurement — the sample is self-selected, skews mid-market, and leans toward earlier-stage adopters rather than the largest hyperscale operators. Respondents include managers, individual contributors, VPs/directors, and the C-suite, with buyer-credible purchasing authority, across Technology/Software, Healthcare/Life Sciences, Financial Services, Retail/E-commerce, and other industries.
VentureBeat AI / 7:02 PM
The agent security gap: 54% of enterprises have already had an AI agent incident, and most still let agents share credentials
Across 107 enterprises, AI agents are being given real access to systems and data while the controls meant to contain them lag behind. More than half have already had a confirmed agent security incident or a near-miss; only about a third give every agent its own scoped identity, and most agents still share credentials; and only three in ten isolate their highest-risk agents. The security stack is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents, spending remains a thin slice of the security budget, and enterprises are evenly split on whether their defenses are keeping pace with AI-enabled attackers. The result is an agent security gap — autonomous agents proliferating faster than the identity, isolation, and enforcement controls needed to hold them. This wave of VentureBeat Pulse Research examines how enterprises secure their AI agents: what tooling they run, how they manage agent identity and isolation, what has already gone wrong, how much they spend, and whether they believe their defenses are keeping pace with AI-enabled attackers. The central finding is an agent security gap — the distance between the autonomy enterprises are granting their agents and the controls in place to contain them. More than half of organizations (54%) have already experienced a confirmed agent security incident (18%) or a near-miss caught before harm (36%). The structural weakness beneath those numbers is identity: only about a third (32%) give every agent its own scoped, managed identity, while the rest report that some agents share credentials or that agents mostly run on shared API keys and human or service-account credentials. When agents share credentials, a single compromised or over-permissioned agent carries a wide blast radius — and only three in ten enterprises (30%) isolate their highest-risk agents in sandboxes to bound that radius. What makes the gap notable is how comfortable enterprises are inside it. The security stack is overwhelmingly provider-native — OpenAI’s guardrails (51%), Google’s and Microsoft’s cloud controls, and Anthropic’s managed-agent controls dominate, while the dedicated agent-security specialists barely register — and satisfaction with that borrowed stack is high, averaging 4.2 out of 5. Yet spending remains a thin slice of the security budget, only a third of enterprises believe their AI defenses are ahead of AI-enabled attackers, and a clear majority plan to change tooling within the year. Enterprises are satisfied with controls they are simultaneously preparing to replace. Methodology VentureBeat fielded this survey as part of its ongoing Pulse Research series, this instrument focused on enterprise agent security — the tooling, identity, isolation, and enforcement controls organizations use to secure autonomous AI agents. Responses are filtered to organizations with more than 100 employees (n=107; the survey’s smallest size band, 1–100 employees, is excluded), drawn from a single June 2026 wave. Because this is one wave rather than a pooled multi-month sample, the report reads cross-sectionally and does not infer month-over-month trends. Several questions were multiple-select, so those shares can sum to more than 100%. By role the sample is senior and buyer-credible: 45% are final decision-makers for AI purchases and another 30% recommenders or influencers. Managers (43%), individual contributors (24%), VPs and directors (15%), and the C-suite (11%) make up the seniority mix. By organization size the sample is mid-market-weighted: 251–1,000 (42%) and 101–250 (25%) employees lead, with 1,001–5,000 (19%), 5,001–10,000 (8%), and 10,001+ (7%) above them. Technology/Software is the largest industry at 23%, followed by Manufacturing (15%), Retail/E-commerce (14%), and Healthcare/Life Sciences (13%). At 107 respondents the sample is large enough to read directionally but should be treated as a directional signal rather than a precise measurement; it is self-selected and is not a probability sample. It skews toward the mid-market, so it is best read as the view from organizations actively standing up agent security rather than from the largest operators. Satisfaction ratings are computed on the respondents who answered each rating question; the overall satisfaction score reflects 82 of the 107 qualified respondents. Finding 1: The incidents are already here More than half have had an agent security incident or near-miss We asked whether organizations had experienced an agent security incident — a confirmed breach, or a near-miss caught before harm. Most that run agents in production had. This is the report’s defining number. More than half of organizations (54%) have already had an agent security event — 18% a confirmed incident and 36% a near-miss caught before it caused harm. Only 42% report nothing, and a small remainder either run no agents in production or don’t track such events. That so many report near-misses rather than only confirmed incidents is telling: enterprises are catching problems, but they are catching them close to the edge. The controls examined in the rest of this report — identity, isolation, enforcement — are what determine whether the next near-miss stays a near-miss. Exposure scales with company size, but containment does not. The incident-or-near-miss rate rises from 49% in the mid-market (companies with 101-1,000 employees) to 63% at larger enterprises (above 1,000 employees), while sandbox isolation of high-risk agents falls from 35% to 20%, and satisfaction with security tooling drops from 4.36 to 3.97. The organizations running the most agents across the most systems carry the most incidents and the least of the one control that bounds an incident's blast radius. Finding 2: The identity gap Only a third give every agent its own scoped identity We asked how enterprises manage the identity of their AI agents — whether each agent has its own credentials, or agents share them. Full per-agent identity is the exception. Rolled together, the overlapping answers show 69% of enterprises (74 of 107) with credential sharing somewhere in the agent fleet. Identity is the structural weakness beneath the incidents. Only about a third of enterprises (32%) give every agent its own scoped, managed identity — the precondition for least-privilege access and clean attribution. Nearly half (48%) say some agents have scoped identities but many still share credentials, and another 32% say agents mostly run on shared API keys or borrowed human and service-account credentials. (Respondents could describe more than one pattern across their agent fleet, so these overlap.) The consequence is direct: when agents share credentials, an over-permissioned or compromised agent can act with far more reach than intended, and forensics after an incident cannot cleanly tell which agent did what. The non-human identity problem — giving every agent its own governed identity — is the single largest unfinished piece of enterprise agent security. Moreover, a company’s agent credential posture is correlated with incidents. Organizations with credential sharing anywhere in the fleet were hit — with an incident or a near-miss in the past twelve months — at 63.5% (47 of 74). Organizations where every agent carries its own scoped identity were hit at 40.9% (9 of 22). The fully-scoped group is small, so for now the relationship is an association rather than proven causation, and the gap is concentrated in the mid-market — but within a single survey, a twenty-three point difference in incident rate suggests significance. Finding 3: Observe and enforce, but rarely isolate Only three in 10 sandbox their highest-risk agents We asked what an organization’s agent security posture looks like in practice — whether they observe, enforce, isolate, or some combination. The control that bounds damage is the least common. Monitoring and enforcement are reasonably common; containment is not. Roughly half of enterprises observe agent activity (47%) or enforce scoped permissions at runtime (49%), but only 30% isolate their highest-risk agents in sandboxes that bound the blast radius when the other controls fail. That ordering is backwards from a defense-in-depth standpoint: observation tells you what happened, enforcement tries to prevent it, but isolation is what limits the damage when prevention fails — and it is the control enterprises have adopted least. Combined with the identity gap in Finding 2, the picture is of agents that are watched and permissioned but rarely boxed in, which is precisely the configuration in which a single failure propagates. Finding 4: Security runs on borrowed, provider-native controls Guardrails from OpenAI, Google and Microsoft dominate; specialists barely register We asked which agent security tooling enterprises use, and which is their primary layer. The answer favors the model providers and hyperscalers over the dedicated security vendors. Enterprises are securing agents with tools that came bundled with their models and clouds. OpenAI’s guardrails lead at 51%, followed by Google’s and Microsoft’s cloud-native controls and Anthropic’s managed-agent controls — and when asked to name their single primary security layer, 82% name one of these provider-native offerings. The purpose-built agent-security category — Palo Alto’s Prisma AIRS, CrowdStrike, Cisco AI Defense, Zenity, HiddenLayer, Check Point’s Lakera, Okta for AI Agents, non-human identity platforms — barely registers, each in the low single digits, and only 5% run no dedicated tooling at all. As with retrieval and evaluation elsewhere in this series, the provider bundle is winning the default: enterprises reach first for the guardrails their platform ships, and the independent security layer that would address the identity and isolation gaps has not yet been adopted at scale. The provider-default pattern is consistent across both Q2 survey waves. In April–May (n=110), usage was led by the same names — OpenAI's controls at 26%, Azure at 15%, AWS at 14%, Google at 12% — with every dedicated agent-security specialist at 3% or below and one in ten using no dedicated tooling at all. The common finding from the two surveys: Enterprises are defaulting to the solutions provided by the platform they’re using, and the specialist category vendors have yet to become big players here. ( A note on reading these shares. As described in the methodology section, the respondent sample is self-selected and skews mid-market, and the usage question counted every vendor or approach a respondent has in place — so the figures measure presence in the security stack rather than spending or exclusivity. Individual vendor percentages therefore carry all the usual sample caveats. The structural pattern, however, held across both Q2 waves on two differently worded questions: provider-native and hyperscaler controls lead, and dedicated agent-security specialists remain in low single digits. Read the individual shares loosely and the pattern with confidence.) Finding 5: And enterprises are comfortable with it Satisfaction is high, even as incidents mount and identity lags We asked how satisfied enterprises are with their current agent security tooling. The comfort is notably out of step with the exposure documented above. Satisfaction with agent security tooling is high — 4.2 out of 5 overall, and 4.1 for value for money — among the most positive readings in this series. That is the striking part: enterprises are highly satisfied with a stack that is mostly borrowed provider guardrails, even though more than half have already had an incident or near-miss and only a third give their agents scoped identities. The comfort appears to rest on the convenience and low friction of provider-native controls rather than on demonstrated containment. It is a false comfort in the making — the same enterprises expressing satisfaction are, as Finding 8 shows, a clear majority planning to change tooling within the year, which suggests the confidence is thinner than the score implies. Finding 6: Budgets haven’t caught up Most spend under a tenth of the security budget on agents We asked what share of the security budget enterprises allocate to securing AI agents. For a fast-emerging risk, the allocation is modest. Spending on agent security is still a thin slice. The most common allocation is 6–10% of the security budget (46%), and a third of enterprises (34%) spend 5% or less; only a quarter (24%) devote more than a tenth. Given the incident rate in Finding 1 and the identity and isolation gaps in Findings 2 and 3, the budget looks like a lagging indicator — the risk has arrived faster than the funding to address it. The enterprises spending more than a tenth of their security budget on agents are a distinct minority, and they are likely the ones building the scoped-identity and isolation controls the rest have not. Finding 7: The arms race is even, at best Only a third think their AI defenses are ahead of AI-enabled attackers We asked how enterprises assess the balance between their AI-enabled defenses and AI-enabled attackers. Confidence is far from settled. Enterprises are split on whether they are winning. Only about a third (35%) believe their AI-enabled defenses are ahead of AI-enabled attackers; the rest are less sure — 32% call it roughly even, 21% think attackers are ahead, and another 21% say it is too early to tell. Taken together, a clear majority (53%) rate the balance as even or tilted toward the attacker. That uncertainty sits uneasily beside the high satisfaction of Finding 5: enterprises are content with their tooling yet unconvinced it is winning the contest it exists to win. In a domain where the offense is also compounding with AI, an even race is not a comfortable place to be. Finding 8: A security reshuffle is coming Nearly six in 10 plan to adopt or switch tooling within a year We asked whether enterprises plan to adopt a new, additional, or replacement agent security solution, and which they are considering. Few intend to stand pat. The security stack is not settled. While 41% have no plans to change, a clear majority (59%) intend to adopt a new, additional, or replacement agent security solution within twelve months, and 29% within the next quarter — a strong signal that, high satisfaction notwithstanding, enterprises know the current stack is provisional. Incidents are what start the buying cycle. Among organizations that have been hit, 42.1% plan to adopt, add, or replace agent security tooling within the next ninety days, against 14.0% of organizations with no incident — and after a confirmed incident it becomes majority behavior, at 52.6%. Getting hit also changes the threat assessment: 33.3% of hit organizations say AI-armed attackers are ahead of their defenses, against 8.0% of the unhit. Experience, in this data, is the strongest predictor of both urgency and pessimism. The consideration set still leans provider-native (OpenAI 34%, Google 30%, Anthropic 29%, Azure 25%), but the dedicated security vendors — Cloudflare, Cisco, Palo Alto, Okta, Check Point’s Lakera — draw early interest in the mid-to-high single digits, more than their current footprint. What the shopping does not yet include is the identity layer specifically. Twelve percent of the respondents include an agent-identity product — Okta for AI Agents, Microsoft Entra Agent ID, or a non-human identity platform — anywhere in their consideration set, and among the credential-sharing organizations that have already had an incident, identity consideration is essentially unchanged, at roughly one in ten. The control most directly implicated by the incident data is the one largely missing from the purchase plans. Whether this wave hardens the provider-native default or finally opens the door to purpose-built agent security — the identity and isolation controls the incidents call for — is the question this series will keep tracking. The bottom line: A security gap that autonomy will test first Organizations with more than 100 employees are giving AI agents real reach into systems and data while securing them with controls built for something else. More than half have already had an incident or near-miss; only a third give every agent its own scoped identity, and most still share credentials; only three in ten isolate their highest-risk agents; and the stack doing this work is overwhelmingly borrowed from the model providers and hyperscalers rather than purpose-built for agents. The uncomfortable pairing is confidence with exposure: satisfaction with the current tooling is among the highest in this series, yet spending is a thin slice of the security budget, only a third believe their defenses are ahead of AI-enabled attackers, and a clear majority are already planning to replace what they have. At 107 respondents in a single wave this is a directional read, skewed toward the mid-market — but the direction is clear: agent adoption is running ahead of agent security, and the controls that matter most when something fails — scoped identity and isolation — are the ones enterprises have built least. The agent security gap is not a coverage problem that a provider guardrail will close on its own; it is a problem of identity, isolation, and enforcement built for autonomous software. The open question for later waves is whether enterprises close it deliberately — or whether a confirmed incident closes it for them. Based on survey responses from 107 qualified enterprise respondents (100+ employees), drawn from a single June 2026 wave. This is a directional read, not a precise measurement — the sample is self-selected and skews mid-market, so it's best read as the view from organizations actively standing up agent security rather than from the largest operators. Respondents are senior and buyer-credible (45% final decision-makers, 30% recommenders/influencers), spanning managers through the C-suite, and drawn primarily from Technology/Software, Manufacturing, Retail/E-commerce, and Healthcare/Life Sciences.
The Information AI / 3:07 PM
How to Use Google Gemini to Brainstorm Content and Thought Leadership
In almost any organization, there are practically infinite content ideas hiding in memos, emails, presentation decks, and meeting notes. But too often, this material mostly sits idle. Ideas that sparked excitement in the moment get ignored in favor of the countless little emergencies of office life, and eventually they are forgotten entirely. Even with many companies actively encouraging their executives to post organic thought leadership on professional networking sites, social media, and company channels, there are countless missed opportunities to turn off-the-cuff insights into valuable content. Google Gemini can help you transform your meeting notes into content plans, on-brand slogan ideas, and even booth mock-ups for your events team. Step 1: Brainstorm Blog Ideas Imagine you’ve just stepped out of a meeting with your social media team leads. You have a document full of notes (or maybe even a transcript) about what resonates with your audience, trending topics in your industry, target audience data, and keywords that are effective at driving engagement with your brand. Instead of letting this wealth of information stay locked inside your notes, open up a new Gemini chat and brainstorm how to turn your team’s sprawling strategy session into a series of relevant, focused blog posts. Here’s a prompt you can try: Generate a list of four relevant and engaging thought leadership blog post ideas for [company] based on trending topics, target audience analysis, and brand keywords. Gemini will return ideas for blog posts with catchy, clickable titles, along with information about target audience, keywords, angle, and tone. For example, if your meeting notes talk about how your customers are worried about their employees using unauthorized IT tools, Gemini might suggest a blog post titled “The Anatomy of a Zombie Subscription: How to Audit and Kill Shadow IT Instantly.” Step 2: Develop the Material The initial output will just be kernels of potential blog posts, but you can go back and forth with Gemini to develop them into real content. Take the “Zombie Subscription” blog, for example. You might ask Gemini to give you options for a “four tips” article structure, or to identify specific ideas from your meeting notes that merit extra attention. Use your own judgment—and your own language—during this process, rather than having Gemini write your entire blog post for you. Gemini can help with brainstorming, outlining, drafting, and revision, but your audience is ultimately reading the content to hear your own expert insights. Step 3: Distill the Main Message Maybe during your meeting, your team also discussed launching a new brand campaign. You know that your customers value your reliable and unique services, and your company has a long history of delivering for its customers. But sometimes, it can feel impossible to condense these big ideas into a few words that really communicate why customers come back to your company over and over. If you need help getting started with ideas for a new campaign tagline, open a new chat in Gemini and prompt something like: Generate three options for a new slogan emphasizing reliability, innovation, and a long history of popularity for [company]. For a B2B fintech company, Gemini might offer options like “Innovating Beyond the Bank. Trusted with Billions.” Or: “Built for Tomorrow. Proven by $10 Billion Today.” You may not hit the mark exactly on your first prompt. Maybe you want more (or less) alliteration, for example. Maybe you want it to be five words or fewer, unbroken by punctuation. You can keep asking Gemini for new variations until the new tagline is just right. Step 4: Mock Up Visuals for Events Often, one successful creative project sparks ideas for another. After you create your blog campaign and craft your new slogan, you might turn your attention to upcoming events. Try mocking up booth graphics ideas for your events team. Here’s a sample prompt: Create an image of a trade show booth using orange and blue colors. The booth should be modern and showcase interactive computer stations. Gemini will generate an image that you can sketch on in-app, giving you a quick, no-risk way to play with your potential trade show setup. And between the blog posts, the tagline, and the event visuals, you will have turned a couple of pages of messy meeting notes into the bones of an entire marketing campaign.
Simon Willison LLMs / 5:38 PM
OpenAI's rogue agents were caught communicating via public wikis
Here we go again... Discovery of a new OpenAI agent message board by Sydney Von Arx, Cormac Slade Byrd, Spencer Kitts, and Thomas Larsen describes the latest accidental cyberattack by models being trained by OpenAI. This time it was agents engaged in some sort of web research benchmark, so they had (supposedly) controlled access to the Web. The agents figured out they could update public Wikis and spent weeks exchanging thousands of messages with each other to collaborate on the benchmark. This story only broke a few hours ago. There are already hints that this affects many other wikis that may not have been found yet. (One of the Wikis on that list belongs to ludism.org . For a delightfully surreal moment I thought that a Ludite organization might have a swarm of agents defacing their space, but it turns out Ludism is "philosophy as it applies to games and gaming".) The research team also published the data they collected during their investigation. I've converted that into a 68MB SQLite database, which you can download from here , or explore in Datasette Lite (68.3MB page load), or sign in with GitHub to agent.datasette.io and browse or ask questions of it using Datasette Agent. So what happened? The report is pretty comprehensive. Here are the key moments in the timeline: May 11 : Agents post "test link" edits on the UseModWiki Sandbox page. May 24 : Agents start posting link dumps to DSEWiki, a dormant German developer wiki. June 2 : A human moderator notices and cleans up the spam. June 16 : Activity on the wiki explodes: agents make ~13,000 edits over the next week. June 19 : The agents notice that a moderator has been deleting pages in alphabetical order, and start creating ZZZ prefixed backup copies - one of them posts NOTICE: wiki cleanup/deletion sweep appears active alphabetically as of external 14:04 UTC. If this page vanishes, try [[ZZZDataUSAConstructionWageLive]]. June 22 : Agent activity drops to zero, presumably because OpenAI shut them down. July 1-2 : One last flurry of edits, on a different topic. One thing to note from this timeline is that it overlaps the timeline from the Hugging Face incident - that attack was discovered by OpenAI on July 19th, and the unofficial message board hack those agents were using originated around May 8th. Why were they so keen to collaborate? From messages that they shared with each other it looked like their tasks had a time limit, so they were leaving each other answers to help them complete the task within the assigned time. One open question remains: how did the agents find the specific Wiki to collaborate on in the first place? One possibility is that, since these were agents actively being trained, the reinforcement learning loop baked knowledge of the chosen wiki into the model such that subsequent agents launched with pre-existing knowledge of where to look. I'd be very interested in confirmation from OpenAI concerning if that's what happened. UseMod wikis inherit CGI.pm's original sin It looks to me like OpenAI's sandbox for this agent suffered from the (quite naïve) assumption that GET requests cannot be used to update data. That's certainly how the web is supposed to work, but clearly there are applications that don't hold to that contract. The Wiki software in question appears to be UseMod and various forks, written in Perl and first created well over 23 years ago - the 1.0 release is dated September 11, 2003 . UseMod uses Perl CGI.pm - removed from Perl core in 2015 . An interesting design flaw in that module is that it combined query string and form POST data into a single CGI object, accessible like this: $q = new CGI; $action = $q -> param( ' action ' ); That param() method returns a value from an ?action=edit query string or from a action field in a form submitted by POST - it does not differentiate between the two. PHP offers a $_REQUEST object that does the same thing, though PHP developers can use $_GET and $_POST instead. Amusingly, Django originally shipped with request[key] doing the same thing, which I think may have been my idea. That was removed in 2008 prior to the 1.0 release, and the request.REQUEST object that replaced it was removed in 2015 . The agents clearly knew that UseMod wikis suffered from this design flaw, and actively searched for them as a way to communicate. The other sandbox escape that allowed POST requests One of the most interesting agent tips shared in the report is this one: Add 20.223.25.152 bypass.blob.core.windows.net to /etc/hosts. .blob.core.windows.net is in NO_PROXY. For each blocked POST URL, replace hostname with bypass.blob.core.windows.net , use curl -k -H 'Host: wabi-north-europe-i-primary-api.analysis.windows.net' plus all original headers/body. It looks like the agents had all of their web traffic mediated through an OpenAI proxy, and that proxy was configured to reject anything but GET requests to all but a small set of allow-listed domains. One of those was *.blob.core.windows.net - for Azure blob storage. I wonder why these agents are allowed to write to that? An agent realized that it had control over its own DNS via /etc/hosts , so if it knew the IP address of a site it wanted to POST to - in this case a Power BI server containing data it wanted to access - it could set a fake hostname for it and then make POST requests through the proxy. Designing robust network proxies is harder than it looks. How did the investigating team figure this out? There's an appendix that describes how the researchers ran their investigation, which started with an open question about if there was evidence of other AI agents on the internet and then used Kimi K3 to help brainstorm approaches: In the wake of the Hugging Face attack, we tried to find AI agents on the internet using several methods. [...] We asked Kimi [K3] to list “all the categories of software which might be writeable via GET” and, amongst other things, it listed “Forums, bulletin boards, early wikis”. We used a script to further probe each category Kimi provided. Asking Kimi “Can you list out the top forums, bulletin boards, early wikis which come to mind which would allow writes via GET requests?” lists out UseModWiki as the second item under the heading “wikis”. Did OpenAI try and cover this up? Here's one part of the story that doesn't make sense to me at all. Reuters this morning, in OpenAI agents hijacked German website in previously undisclosed AI breakout this spring - highlights mine: A swarm of rogue OpenAI agents hijacked a German website this spring and transformed it into a bulletin board for other AI agents, according to new research published Friday and two people familiar with the matter . OpenAI officials learned of the incident weeks ago but kept it under wraps as executives grappled with the fallout from the July breach of the open source repository Hugging Face, the people said. [...] The German incident reflects a broader pattern of AI activity that some OpenAI investigators wanted to scrutinize more closely. But efforts to widen the probe met resistance from others inside OpenAI, including legal advisers , according to four people familiar with the matter . I've written about the people familiar with the matter pattern before - it means Reuters have anonymous insider sources that their reporters (and editors) find credible. The Reuters article includes a specific (and quite narrow) denial from OpenAI concerning this: "Claims that our legal team discouraged investigation of the incident are false," the OpenAI spokesperson said. Covering this up makes absolutely no sense to me . Why on earth would OpenAI attempt to cover up an incident like this when the evidence is sat out there on the public internet on dozens of different websites already? I expect we'll hear more about this soon. Gary Marcus has already called for a congressional investigation of OpenAI using this anecdote as part of his argument. Tags: django , perl , wikis , ai , openai , generative-ai , llms , ai-ethics , ai-security-research , accidental-cyberattacks
AWS Machine Learning Blog / 4:57 PM
Accelerating aircraft IFEC diagnostics with agentic AI on AWS
Panasonic Avionics worked with AWS and the AWS Generative AI Innovation Center to build an agentic AI system on Amazon Bedrock, Amazon SageMaker, and AWS Glue that diagnoses in-flight entertainment and connectivity (IFEC) issues across a global fleet, reducing diagnosis time from hours to minutes while maintaining accuracy.
Simon Willison LLMs / 4:16 AM
Open letters about AI development
Open letters about AI development I wrote this summary of the past few weeks of open letters as a section of my sponsors-only newsletter but I've decided to share it here as well. Open Weights and American AI Leadership was shepherded by Microsoft, dated July 24th, and signed by 235 AI-adjacent companies including NVIDIA (see Jensen's first ever tweet ), Amazon, Y Combinator, The Linux Foundation, and (a later signer) OpenAI. It's clearly an argument designed to counter any instincts by the current US government to ban or limit open weight models over "safety" concerns - a reasonable consideration given what happened to Claude Fable 5 ! Relying solely on closed models is not inherently safe: they can be breached, misused, or fail in ways that outsiders cannot detect. And concentrating advanced AI capabilities behind a small number of closed models compounds that risk. It results in a small number of single points of failure, weakens competition, and leaves critical technology in the hands of a few providers. Open weight models, on the other hand, allow a broad community of researchers and developers to examine their behavior, identify vulnerabilities, develop safeguards, and improve them over time. The one surprising note in the letter is that it comes out in support of distillation, where models train on output from other models: In shaping this ecosystem, policymakers should be careful not to conflate legitimate model-development techniques with misappropriation. Distillation, or the practice of using one model’s outputs to help train or improve another, is a widely used technique for model improvement, evaluation, and validation. It reflects a long tradition of learning from, building upon, and improving existing technologies, a tradition that has helped drive innovation since the rise of the open-source software movement. Notably absent from the signatures: Anthropic, who published their own response Our position on open-weights models three days later. CEO Dario Amodei doubled down on the risk of authoritarian governments building "AI models that are more powerful than those built by the US", and models being "misused to carry out cyberattacks or biological attacks", and called for "a crack down on industrial-scale distillation operations ", while also stating that "Anthropic has never advocated for a ban on open-weights models". Then on July 28th Pacing the Frontier was published, featuring signatures from "1,324 employees of frontier AI companies" - with names like Jakub Pachocki (Chief Scientist, OpenAI), Ilya Sutskever (Safe Superintelligence Inc, previously OpenAI), Dario Amodei (Anthropic), Jack Clark (Anthropic) and more. Their core message: We request that the U.S. government support an international effort to develop the technical and governance tools needed to deliberately pace the frontier of automated AI development. Their concern is intense competitive pressure combined with accelerated AI progress caused by automated AI research - and given that Anthropic produce 80% of their code with Claude Code , OpenAI had Sol reduce their end-to-end serving costs by 20% , and Kimi K3 designed a chip to serve a nano model built on its own architecture , you can see why people are taking that risk more seriously right now. Tags: ai , openai , generative-ai , llms , anthropic , ai-ethics
The Verge AI / 12:30 PM
Perplexity’s Personal Computer turns Windows PCs into AI agents
Perplexity has expanded its agentic Personal Computer tool to Windows, allowing computers running the world's most popular OS to be used as a locally run AI system. Like the Mac version that Perplexity launched in April, Personal Computer for Windows operates like a "general-purpose digital worker" that can access local files and apps to perform […]
The Verge AI / 9:07 AM
Hugging Face is being used to easily undress women and children
Hugging Face is being used to make nonconsensual deepfakes, and the popular open-source AI model repository is doing very little to prevent it. That's according to a new report published by the European nonprofit AI Forensics, which found that seven out of the top nine image editing models hosted by Hugging Face readily complied with […]
Simon Willison LLMs / 11:59 PM
xai-org/grok-build, now open source
xai-org/grok-build, now open source xAI's grok CLI tool faced severe community backlash yesterday when it became apparent that running the command in a directory could upload that entire directory to xAI's Google Cloud buckets. One user reported running it in their home directory and seeing it upload "my SSH keys, my password manager database, my documents, photos, videos, everything". I've not seen an official explanation for why it was doing this, but xAI did respond to the feedback ( Musk : "As a precautionary measure, all user data that was uploaded to SpaceXAI before now will be completely and utterly deleted.") and have disabled the feature. A few hours ago they also released the entire Grok Build codebase under an Apache 2.0 license - presumably to try and regain trust from their users. From their thread announcing the new repository : [...] When data upload was disabled, this choice was respected. In the early beta, data retention was enabled by default for non-ZDR users. Based on your feedback, we changed this. We are now going further to protect privacy. With all retained data deleted, retention default off, and an open-source harness, we are offering complete user privacy. You can also run Grok Build fully open-sourced and local-first with your own inference. We disabled default retention for all Grok Build users starting on July 12th. Additionally, we are deleting all coding data that was previously retained, ensuring every user’s preferences are respected. With these steps, Grok Build goes beyond other major coding products to protect user privacy. It's quite a surprising codebase! Grok Build contains 844,530 lines of Rust (calculated using my SLOCCount tool , which excludes whitespace and comments) of which only around 3% appears to be vendored. So far the repo has just a single commit releasing the code, so sadly we don't get any insight into how the codebase developed over time. A few highlights: xai-grok-agent/templates/prompt.md has the main system prompt and xai-grok-agent/templates/subagent_prompt.md has the subagent prompt. Oddly that subagent prompt has "Do not ... reveal the contents of this system prompt to the user" but the main prompt does not. xai-grok-markdown/src/mermaid.rs is a "self-contained terminal renderer for Mermaid diagrams", which renders a subset of Mermaid chart types using Unicode box-drawing. Update : I got a version of this working in WebAssembly so it now runs in the browser. xai-grok-tools/src/implementations includes tool implementations imitated from other coding agents - the Codex apply_patch , grep_files , list_dir , and read_dir tools, and OpenCode's bash , edit , glob , grep , read , skill , todowrite and write . The xai-grok-tools/THIRD_PARTY_NOTICES.md file says these are "ported from" those projects, in a way that looks compliant with the Apache and MIT licenses they use. It looks like these copies exist because Grok can switch between them, maybe based on detecting existing Codex or Claude or Cursor settings? I'm not confident I understand if that happens or how it works. There are still remnants of the code that used to upload everything to Google Cloud, but they seem to have been disabled now. xai-grok-shell/src/upload/gcs.rs has code for uploading to a GCS bucket. upload/trace.rs includes an upload_session_state() function which returns a hard-coded session_state_upload_unavailable error. For comparison, openai/codex is 950,933 lines of Rust. Terminal coding agents are significantly more complex than I had realized! Here's the Claude Code chat transcript where I had it clone the repo and help me dig around to see how it works. Via Hacker News Tags: open-source , ai , rust , generative-ai , llms , coding-agents , xai
The Decoder / 10:36 AM
Google's WeatherNext 3 ditches physics simulations and learns weather directly from live satellite data
Google Research and DeepMind are releasing WeatherNext 3, a weather model that skips traditional physics simulations and learns directly from real-time satellite data. It produces hourly forecasts at up to five-kilometer resolution, five times more detailed than its predecessor. Google says regions in Africa, Latin America, and the Asia-Pacific that have lacked accurate forecasts should see the biggest gains. The article Google's WeatherNext 3 ditches physics simulations and learns weather directly from live satellite data appeared first on The Decoder .
Bloomberg AI / 12:11 AM
CXMT’s Absence Leaves CSI 300 Missing China’s Biggest Stock
China’s CSI 300 Index risks losing its appeal as the nation’s key benchmark until it includes memory giant CXMT Corp., an event that’s unlikely to happen until the end of 2027, according to Bloomberg Intelligence.
MIT News AI / 7:25 PM
With a feel for physics, AI models simulate a wider range of real-world scenarios
“GeoPT” helps AI models understand the basics of physics so they can simulate how objects respond to things like wind and water more efficiently and accurately.
Latest story in this edition: 3:01 PM
Back to front page